CVE-2025-7464

osrg GoBGP rtr.go SplitRTR out-of-bounds

State: Published
Severity: 6.3 Medium
Published: Jul 12, 2025
Updated: Jul 14, 2025
Reserved: Jul 11, 2025

Description

A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The name of the patch is e748f43496d74946d14fed85c776452e47b99d64. It is recommended to apply a patch to fix this issue.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C	VulDB
3.0	3.7 Low	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C	VulDB
2.0	2.6 Low	AV:N/AC:H/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-125 Out-of-Bounds Read
CWE-119 Memory Corruption

Affected Products

Product	Versions
GoBGPosrg	3.0Affected 3.1Affected 3.2Affected 3.3Affected 3.4Affected 3.5Affected 3.6Affected 3.7Affected 3.8Affected 3.9Affected 3.10Affected 3.11Affected 3.12Affected 3.13Affected 3.14Affected 3.15Affected 3.16Affected 3.17Affected 3.18Affected 3.19Affected 3.20Affected 3.21Affected 3.22Affected 3.23Affected 3.24Affected and 13 more versions

References

VDB-316116 | osrg GoBGP rtr.go SplitRTR out-of-boundsvdb-entrytechnical-description
VDB-316116 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #610193 | NTT Open Source GoBGP defe9ac1b1f1c854d1941a5b70dee3aaed6fb960 Out-of-Bounds Readthird-party-advisory
https://github.com/osrg/gobgp/commit/e748f43496d74946d14fed85c776452e47b99d64patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.